gh-155752: Do not crash when GenericAlias parameters change during substitution - #155761
Conversation
…ing substitution An alias argument can gain __typing_subst__ after __parameters__ has been cached, including during a preparation or substitution callback. Check that the argument is present before indexing the substitution arguments.
|
All commit authors signed the Contributor License Agreement. |
picnixz
left a comment
There was a problem hiding this comment.
My comment is just a nitpick btw
|
Thanks @dariushoule for the PR, and @JelleZijlstra for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14, 3.15. |
|
GH-155770 is a backport of this pull request to the 3.15 branch. |
|
GH-155771 is a backport of this pull request to the 3.14 branch. |
|
Sorry, @dariushoule and @JelleZijlstra, I could not cleanly backport this to |
|
GH-155772 is a backport of this pull request to the 3.13 branch. |
|
Sorry, @dariushoule and @JelleZijlstra, I could not cleanly backport this to |
|
Sorry, @dariushoule and @JelleZijlstra, I could not cleanly backport this to |
|
@JelleZijlstra @picnixz |
…ring substitution (GH-155761) (#155770) gh-155752: Do not crash when GenericAlias parameters change during substitution (GH-155761) An alias argument can gain __typing_subst__ after __parameters__ has been cached, including during a preparation or substitution callback. Check that the argument is present before indexing the substitution arguments. (cherry picked from commit c0006fa) Co-authored-by: Darius Houle <dariushoule@gmail.com>
…ing substitution (python#155761) An alias argument can gain __typing_subst__ after __parameters__ has been cached, including during a preparation or substitution callback. Check that the argument is present before indexing the substitution arguments.
|
I'm assuming they were added by accident so I've removed them, this seems like a regular bug to me. |
|
I think we usually backport crashes as far as we can since they can be security vulnerabilities; segfaults can corrupt memory, etc |
Under our security policy I don't see how this qualifies, I don't think a bug is a vulnerability simply because it causes a segfault. Vulnerabilities can be exploited, whereas this does not seem like something exploitable in code that may exist in the real world. |
Fixes #155752
_Py_subs_parameters()assumed that every argument with a__typing_subst__attribute was present in the cached__parameters__tuple. However,__typing_subst__can be added to an argument after__parameters__has been cached, causing the lookup to return -1, which is subsequently looked up.Check the lookup result before indexing the substitution arguments and raise
TypeErrorwhen the changed argument is not in__parameters__.